Re: [Mailman-Users] FW: Spamassassin content preview ending up posted to list

[Mark Sapiro]

On 11/05/2014 08:15 PM, Mark Sapiro wrote:
> 
> OK. I poked around and found the archived message at
> .
> 
> Something seemed to think that the line between 'Greg Roberts? [...]'
> and 'Content analysis details:' was empty even though in your post at
> least, it contains an ascii space.
> 
> An 'empty' line, i.e. the sequence  terminates the
> headers and the rest is the body.
> 
> This is really wierd because in the archived message, the List-* and
> X-Mailman headers are all added after the X-Spam-Flag: NO header which
> says at the point Mailman added those headers, it knew that the headers
> didn't end at the point prior to the "Content preview" line, but when
> the message was archived and presumably when sent to the list, that line
> started the 'body'
> 
> Also, if you base64 decode the encoded data at the end of the archived
> message, you see the actual plain text message body with some list
> footers added, and curiously, it too is missing the dot in the URL.


Additional question.

Did the post delivered to the list look like the archived message or was
the body just

> I heard or saw 5 Lewin's Rails and 12 Spotless Crakes today at a newly
> discovered wetland at Yandina Creek on the Sunshine Coast. Other good
> birds about included Black-necked Stork, Red-necked Avocet, Little
> Grassbird and a free-flying Mallard; genuinely wild Mallards are rare
> in south-east Queensland.
> This extensive area of grassland and wetland has enormous potential
> but is threatened by development. The Sunshine Coast Regional Council
> is being urged to purchase some of the privately owned land to
> conserve and manage the wetlands.
> See here for pictures, further information and a link where people can
> contact the mayor if they want to see the area protected:
> http://sunshinecoastbirdsblogspot.com.au/2014/11/yandina-creek-wetlands-and-its.html
> Greg Roberts 
> 
> 
>  Birding-Aus mailing list
>  birding-...@birding-aus.org
>  To change settings or unsubscribe visit:
>  http://birding-aus.org/mailman/listinfo/birding-aus_birding-aus.org
> 

as decoded from the base64 in the archive? I suspect the latter. If so,
it's only the archiving process (which appears to not be Mailman's
pipermail) which mis-interpreted the end of the headers. Then the only
mystery that remains is the missing dot in the body. I think the dot
must have been missing in at least the text/plain part of the original
post. It's too much of a coincidence to think that spamassassin dropped
it in it's report before the message even reached the list and Mailman
also dropped it. I can't explain why it was present in the text/plain
part of the message you posted, but perhaps the forwarding from Outlook
to gmail reconstructed the text/plain from the text/html, admittedly a
stretch, but I have no real explanation.

[Composed before I read your last]

-- 
Mark Sapiro The highway is for gamblers,
San Francisco Bay Area, Californiabetter use your sense - B. Dylan
--
Mailman-Users mailing list Mailman-Users@python.org
https://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://wiki.list.org/x/AgA3
Security Policy: http://wiki.list.org/x/QIA9
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
Unsubscribe: 
https://mail.python.org/mailman/options/mailman-users/archive%40jab.org

Re: [Mailman-Users] FW: Spamassassin content preview ending up posted to list

[Mark Sapiro]

On 11/05/2014 05:50 PM, Peter Shute wrote:
...
> X-Ham-Report: Spam detection software, running on the system 
> "cloud3.emwd.com", has  identified this incoming email as possible spam.  The 
> original message  has been attached to this so you can view it (if it isn't 
> spam) or label  similar future email.  If you have any questions, see  
> root\@localhost for details.
>  
>  Content preview:  I heard or saw 5 Lewin's Rails and 12 Spotless Crakes today
> at a newly discovered wetland at Yandina Creek on the Sunshine Coast. 
> Other
> good birds about included Black-necked Stork, Red-necked Avocet, Little 
> Grassbird
> and a free-flying Mallard; genuinely wild Mallards are rare in south-east
> Queensland. This extensive area of grassland and wetland has enormous 
> potential
> but is threatened by development. The Sunshine Coast Regional Council is
>being urged to purchase some of the privately owned land to conserve and 
> manage
> the wetlands. See here for pictures, further information and a link where
> people can contact the mayor if they want to see the area protected: 
> http://sunshinecoastbirdsblogspot.com.au/2014/11/yandina-creek-wetlands-and-its.html
> Greg Roberts? [...] 
>  
>  Content analysis details:   (-0.9 points, 5.0 required)
>  


OK. I poked around and found the archived message at
.

Something seemed to think that the line between 'Greg Roberts? [...]'
and 'Content analysis details:' was empty even though in your post at
least, it contains an ascii space.

An 'empty' line, i.e. the sequence  terminates the
headers and the rest is the body.

This is really wierd because in the archived message, the List-* and
X-Mailman headers are all added after the X-Spam-Flag: NO header which
says at the point Mailman added those headers, it knew that the headers
didn't end at the point prior to the "Content preview" line, but when
the message was archived and presumably when sent to the list, that line
started the 'body'

Also, if you base64 decode the encoded data at the end of the archived
message, you see the actual plain text message body with some list
footers added, and curiously, it too is missing the dot in the URL.

I created a composite message with the body from the 'forwarded' message
from your post and the headers from Outlook, and posted it to a list on
my development server, and it all worked as expected and the only
missing dot was in the X-Ham-Report: "Content preview".

The fact that the dot is also missing in the base64 encoded plain text
says it may well have been missing in the original, but it wasn't
missing in the message quoted in your post, so that's a mystery.

Anyway, your Mailman or at least its archiving process seems to be to
blame here, but mine works, and yours is cPanel so see


-- 
Mark Sapiro The highway is for gamblers,
San Francisco Bay Area, Californiabetter use your sense - B. Dylan
--
Mailman-Users mailing list Mailman-Users@python.org
https://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://wiki.list.org/x/AgA3
Security Policy: http://wiki.list.org/x/QIA9
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
Unsubscribe: 
https://mail.python.org/mailman/options/mailman-users/archive%40jab.org

[Mailman-Users] FW: Spamassassin content preview ending up posted to list

[Peter Shute]

Sorry, I forgot to Cc the list. 

-Original Message-
From: Peter Shute 
Sent: Thursday, 6 November 2014 12:49 PM
To: 'Mark Sapiro'
Subject: RE: [Mailman-Users] Spamassassin content preview ending up posted to 
list

The dot was missing in the X-Ham-Report header but not in the message body in 
the moderation notice.

It was missing from both in the message the list sent out, which made me think 
the list thought the content preview in the X-Ham-Report header was the 
message, and discarded the rest.

I received the moderation notice via Exchange/Outlook, so I'm not sure there 
isn't more to it that I can't see. Outlook will only show me the headers, not 
the whole raw message. In an attempt to get a raw message for you to look at, I 
opened the message attached tot he moderation notice, then used Outlook's 
Resend option to send it to my gmail account. Below is what gmail calls the 
"original message". However, you'll notice that there is no X-Ham-Report 
header! I'm assuming Outlook/Exchange or gmail stripped it out on the way to my 
gmail mailbox. So I've added the headers I see in Outlook below the full 
message.

It might be that Outlook/Exchange has totally rewritten the headers and 
content, so apologies if that's the case.

The difference between these and what arrived from the list is that it's plain 
text only, and the URL mentioned hase changed from:
http://sunshinecoastbirds.blogspot.com.au/2014/11/yandina-creek-wetlands-and-its.html
to:
http://sunshinecoastbirdsblogspot.com.au/2014/11/yandina-creek-wetlands-and-its.html

Note that the first dot in the URL has gone. The only place I can see a 
matching URL is in the content preview.

Delivered-To: xx...@gmail.com
Received: by 10.217.2.18 with SMTP id o18csp37651wes;
Wed, 5 Nov 2014 14:41:09 -0800 (PST)
X-Received: by 10.68.211.193 with SMTP id ne1mr168364pbc.49.1415227268221;
Wed, 05 Nov 2014 14:41:08 -0800 (PST)
Return-Path: 
Received: from NUWVICMS2.nuw.org.au (mailout.nuw.org.au. [202.183.101.44])
by mx.google.com with ESMTPS id rg11si4172892pdb.142.2014.11.05.14.41.06
for 
(version=TLSv1 cipher=ECDHE-RSA-AES128-SHA bits=128/128);
Wed, 05 Nov 2014 14:41:07 -0800 (PST)
Received-SPF: none (google.com: x...@nuw.org.au does not designate permitted 
sender hosts) client-ip=202.183.101.44;
Authentication-Results: mx.google.com;
   spf=neutral (google.com: x...@nuw.org.au does not designate permitted 
sender hosts) smtp.mail=x...@nuw.org.au
Received: from NUWVICMS2.nuw.org.au ([192.168.0.36]) by nuwvicms2
 ([192.168.0.36]) with mapi; Thu, 6 Nov 2014 09:41:03 +1100
From: Peter Shute 
To: "'xx...@gmail.com'" 
Date: Thu, 6 Nov 2014 09:41:02 +1100
Subject: Lewin's Rail, Spotless Crake and other Good Birds at Threatened  
Sunshine Coast Wetland
Thread-Topic: Lewin's Rail, Spotless Crake and other Good Birds at  Threatened 
Sunshine Coast Wetland
Thread-Index: Ac/4qG3uhKgRA3eBQdqoWtgYFONxDQ==
Message-ID: 
Reply-To: Greg yyy 
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ironport-av: E=Sophos;i="5.07,317,1413216000";
d="scan'208,217";a="377715616"
x-originating-ip: 124.150.99.243
x-spam-status: No, score=-0.9
x-ironport-anti-spam-result: 
Ah8LAJiYWVQKAiw6/2dsb2JhbABbgkhGVFkEgjK4XQaTWohlFgEBAQEBfYN5M24GAQk1AkIdG4gjAQETDqJGhzWIDYcBjjSGN41XgVQFhiKLf2KDb485A44ygVMBYIFWKy8BgUeBAwEBAQ
x-ironport-anti-spam-filtered: true
x-spam-flag: NO
x-spam-score: -8
x-spam-bar: /
acceptlanguage: en-US
Content-Type: multipart/alternative;
boundary="_000_C2F1879073AE7347BAB44065F143E17001826088F7nuwvicms2_"
MIME-Version: 1.0

--_000_C2F1879073AE7347BAB44065F143E17001826088F7nuwvicms2_
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64

DQpJIGhlYXJkIG9yIHNhdyA1IExld2luJ3MgUmFpbHMgYW5kIDEyIFNwb3RsZXNzIENyYWtlcyB0
b2RheSBhdCBhIG5ld2x5IGRpc2NvdmVyZWQgd2V0bGFuZCBhdCBZYW5kaW5hIENyZWVrIG9uIHRo
ZSBTdW5zaGluZSBDb2FzdC4gT3RoZXIgZ29vZCBiaXJkcyBhYm91dCBpbmNsdWRlZCBCbGFjay1u
ZWNrZWQgU3RvcmssIFJlZC1uZWNrZWQgQXZvY2V0LCBMaXR0bGUgR3Jhc3NiaXJkIGFuZCBhIGZy
ZWUtZmx5aW5nIE1hbGxhcmQ7IGdlbnVpbmVseSB3aWxkIE1hbGxhcmRzIGFyZSByYXJlIGluIHNv
dXRoLWVhc3QgUXVlZW5zbGFuZC4NCg0KVGhpcyBleHRlbnNpdmUgYXJlYSBvZiBncmFzc2xhbmQg
YW5kIHdldGxhbmQgaGFzIGVub3Jtb3VzIHBvdGVudGlhbCBidXQgaXMgdGhyZWF0ZW5lZCBieSBk
ZXZlbG9wbWVudC4gVGhlIFN1bnNoaW5lIENvYXN0IFJlZ2lvbmFsIENvdW5jaWwgaXMgYmVpbmcg
dXJnZWQgdG8gcHVyY2hhc2Ugc29tZSBvZiB0aGUgcHJpdmF0ZWx5IG93bmVkIGxhbmQgdG8gY29u
c2VydmUgYW5kIG1hbmFnZSB0aGUgd2V0bGFuZHMuDQoNClNlZSBoZXJlIGZvciBwaWN0dXJlcywg
ZnVydGhlciBpbmZvcm1hdGlvbiBhbmQgYSBsaW5rIHdoZXJlIHBlb3BsZSBjYW4gY29udGFjdCB0
aGUgbWF5b3IgaWYgdGhleSB3YW50IHRvIHNlZSB0aGUgYXJlYSBwcm90ZWN0ZWQ6DQoNCmh0dHA6
Ly9zdW5zaGluZWNvYXN0YmlyZHMuYmxvZ3Nwb3QuY29tLmF1LzIwMTQvMTEveWFuZGluYS1jcmVl
ay13ZXRsYW5kcy1hbmQtaXRzLmh0bWwNCg0KR3JlZyBSb2JlcnRzDQoNCg==

--_000_C2F1879073AE7347BAB44065F143E17001826088F7nuwvicms2_
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: base64

PGh0bWw+PGJvZHkgc3R5bGU9ImZvbn

Re: [Mailman-Users] Spamassassin content preview ending up posted to list

[Mark Sapiro]

On 11/05/2014 01:03 PM, Peter Shute wrote:
> 
> Looking at the original message in the moderation alert email, it looks ok to 
> me, but I can see that the dot has been dropped in the content preview in the 
> X-Ham-Report header which I think spamassassin has inserted. This header has 
> multiple lines, including blank lines, and I'm wondering if it's confusing 
> mailman.


So, if I understand correctly, the missing dot is only in an
X-Ham-Report header. Was this header correct in the moderation notice?

Or are you saying that the dot was present in the body of the message in
the held message notice, but not in the body of the delivered message?

It would help if you could post the entire RAW message that was attached
to the held message notice (address obfuscation OK) and point out how
this differs from the message delivered to the list.

In any case, Mailman (actually the underlying Python library) might
possibly unfold and refold the X-Ham-Report header, but other than that,
it should be untouched and have no effect on Mailman.

Is it possible that the original message in the held notice was
multipart/alternative with text/plain and text/html alternatives, and
you saw the text/html alternative which was correct, but this was
removed by Mailman's content filtering collapse_alternatives leaving the
text/plain part which wasn't? If that's the case, blame the user's MUA
(if it's Yahoo, it's almost certainly the culprit).

-- 
Mark Sapiro The highway is for gamblers,
San Francisco Bay Area, Californiabetter use your sense - B. Dylan
--
Mailman-Users mailing list Mailman-Users@python.org
https://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://wiki.list.org/x/AgA3
Security Policy: http://wiki.list.org/x/QIA9
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
Unsubscribe: 
https://mail.python.org/mailman/options/mailman-users/archive%40jab.org

[Mailman-Users] Spamassassin content preview ending up posted to list

[Peter Shute]

I had a complaint yesterday that a URL in a posting to our list had become 
corrupted - one of the dots in the domain name had been dropped.

Looking at the original message in the moderation alert email, it looks ok to 
me, but I can see that the dot has been dropped in the content preview in the 
X-Ham-Report header which I think spamassassin has inserted. This header has 
multiple lines, including blank lines, and I'm wondering if it's confusing 
mailman.

Has anyone else seen this, and is there a way to stop it happening?

Peter Shute
--
Mailman-Users mailing list Mailman-Users@python.org
https://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://wiki.list.org/x/AgA3
Security Policy: http://wiki.list.org/x/QIA9
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
Unsubscribe: 
https://mail.python.org/mailman/options/mailman-users/archive%40jab.org

Re: [Mailman-Users] Archive not woring on Debian install

[Olivier Nicole]

Thank you.

>> I am new to mailman (as a site admin) and I cannot find out how to get
>> the archive running on my debian/postfix/mailman installation.
>>
>> The list works fine, but it seems that no crontab is working.
>
> Your cron jobs are probably mailing their error output to 'mailman'
> which is the site list which probably doesn't accept the posts.

No they are not doing anything.

> You need to either configure the 'mailman' site list to accept all posts
> (in particular set generic_nonmember_action to Accept) and subscribe
> yourself to the list, or add MAILTO=your_address to Mailman's crontab or
> both.
>
>
>> If I try to manually sudo -u list /usr/lib/mailman/cron/mailpasswds is
>> sends no password reminder.
> Does it produce any output? If so, what? If not, are the lists'
> send_reminders settings Yes and are the members' "Get password reminder
> email for this list?" settings Yes?

I have overlooked that setting, now it works.

>> I must be forgetting something very obvious, But I can't see what it is.
> It may be a permissions issue. try
>
> sudo /usr/lib/mailman/bin/check_perms -f

It was and check_perms fixed it.

Thank you,

Olivier

> Otherwise, what's in Mailman's 'error' log?
>
> --
> Mark Sapiro The highway is for gamblers,
> San Francisco Bay Area, Californiabetter use your sense - B. Dylan
> --
> Mailman-Users mailing list Mailman-Users@python.org
> https://mail.python.org/mailman/listinfo/mailman-users
> Mailman FAQ: http://wiki.list.org/x/AgA3
> Security Policy: http://wiki.list.org/x/QIA9
> Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
> Unsubscribe: 
> https://mail.python.org/mailman/options/mailman-users/olivier.nicole%40cs.ait.ac.th
--
Mailman-Users mailing list Mailman-Users@python.org
https://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://wiki.list.org/x/AgA3
Security Policy: http://wiki.list.org/x/QIA9
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
Unsubscribe: 
https://mail.python.org/mailman/options/mailman-users/archive%40jab.org